CVE-2022-24695

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non-Discoverable mode. By conducting an efficient over-the-air attack, an attacker can fully extract the permanent, unique Bluetooth MAC identifier, along with device capabilities and identifiers, some of which may contain identifying information about the device owner. This additionally allows the attacker to establish a connection to the target device.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-203

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-246967.8Mirametrix Glance before 5.1.1.42207 (released on 2018-08-30) allows a local attacker to elevate privileges. NOTE: this is unrelated to prod CVE-2022-246979.8Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu CVE-2022-24706.1Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.CVE-2022-247007.5An issue was discovered in WinAPRS 2.9.0. A buffer overflow in DIGI address processing for VHF KISS packets allows a remote attacker to caus CVE-2022-247017.8An issue was discovered in WinAPRS 2.9.0. A buffer overflow in national.txt processing allows a local attacker to cause a denial of service CVE-2022-247029.8An issue was discovered in WinAPRS 2.9.0. A buffer overflow in the VHF KISS TNC component allows a remote attacker to achieve remote code ex CVE-2022-247049.8The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is c CVE-2022-247059.8The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed bu CVE-2022-247069.8In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin pr CVE-2022-247078.8Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection CVE-2022-247085.4Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to CVE-2022-247096.1@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface